toki/mattermost-mobile
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

include encoded

Browse source
This commit is contained in:
Caleb Roseland 2023-10-18 16:56:14 -05:00
parent 392dd21c0f
commit fc7d8a3d08
2 changed files with 33 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
app/utils/deep_link/index.ts
View file

@ -118,7 +118,12 @@ export function parseDeepLink(deepLinkUrl: string): DeepLinkWithData {
try {
const url = removeProtocol(decodeURIComponent(deepLinkUrl));
if (url.includes('../') || url.includes('/..')) {
if (
url.includes('../') ||
url.includes('/..') ||
url.includes('..%2f') ||
url.includes('%2f..')
) {
return {type: DeepLink.Invalid, url: deepLinkUrl};
}

38
app/utils/url/test.ts
View file

@ -139,22 +139,22 @@ describe('UrlUtils', () => {
{
name: 'should return null if all inputs are empty',
input: {url: '', serverURL: '', siteURL: ''},
expected: {type: 'invalid'},
expected: {type: DeepLinkType.Invalid},
},
{
name: 'should return null if any of the input is null',
input: {url: '', serverURL: '', siteURL: null},
expected: {type: 'invalid'},
expected: {type: DeepLinkType.Invalid},
},
{
name: 'should return null if any of the input is null',
input: {url: '', serverURL: null, siteURL: ''},
expected: {type: 'invalid'},
expected: {type: DeepLinkType.Invalid},
},
{
name: 'should return null if any of the input is null',
input: {url: null, serverURL: '', siteURL: ''},
expected: {type: 'invalid'},
expected: {type: DeepLinkType.Invalid},
},
{
name: 'should return null for not supported link',
@ -163,12 +163,12 @@ describe('UrlUtils', () => {
serverURL: SERVER_URL,
siteURL: SITE_URL,
},
expected: {type: 'invalid'},
expected: {type: DeepLinkType.Invalid},
},
{
name: 'should return null despite url subset match',
input: {url: 'http://myserver.com', serverURL: 'http://myserver.co'},
expected: {type: 'invalid'},
expected: {type: DeepLinkType.Invalid},
},
{
name: 'should match despite no server URL in input link',
@ -186,6 +186,24 @@ describe('UrlUtils', () => {
type: DeepLinkType.Permalink,
},
},
{
name: 'should return null for invalid deeplink',
input: {
url: DEEPLINK_URL_ROOT + '/ad-1/channels/../town-square',
serverURL: SERVER_URL,
siteURL: SITE_URL,
},
expected: {type: DeepLinkType.Invalid},
},
{
name: 'should return null for encoded invalid deeplink',
input: {
url: DEEPLINK_URL_ROOT + '/ad-1/channels/%252f..%252ftown-square',
serverURL: SERVER_URL,
siteURL: SITE_URL,
},
expected: {type: DeepLinkType.Invalid},
},
{
name: 'should match channel link',
input: {
@ -247,7 +265,7 @@ describe('UrlUtils', () => {
serverUrl: URL_PATH_NO_PROTOCOL,
teamName: 'ad-1',
},
type: 'permalink',
type: DeepLinkType.Permalink,
},
},
{
@ -263,7 +281,7 @@ describe('UrlUtils', () => {
serverUrl: URL_PATH_NO_PROTOCOL,
teamName: 'ad-1',
},
type: 'permalink',
type: DeepLinkType.Permalink,
},
},
{
@ -273,9 +291,7 @@ describe('UrlUtils', () => {
serverURL: SERVER_WITH_SUBPATH,
siteURL: SERVER_WITH_SUBPATH,
},
expected: {
type: 'invalid',
},
expected: {type: DeepLinkType.Invalid},
},
];